UK GDPR Article 13: what your privacy notice leaves out

The rule

Article 14 is the companion for data not obtained from the person: it asks for the categories of data and, in paragraph 2, the source, and requires the information within a reasonable period and at the latest one month after the data is obtained, at first communication or at first disclosure to another recipient, whichever comes first.

Maximum penalties sit in the upper tier. Article 83(5)(b) of the UK GDPR, which covers the rights of data subjects, sets a ceiling of £17,500,000 or 4% of total worldwide annual turnover, whichever is higher, and section 157 of the Data Protection Act 2018 sets the same “higher maximum amount”.

What PeekWell checks and how

UK-07 asks one question: does the privacy notice the site links to say what Articles 13 and 14 list? It’s the question EU-08 asks, read against the UK wording.

The scan is automated. It finds the privacy notice linked from your public pages and reads it against the items those articles list: who you are, purposes and legal basis, recipients, transfers, retention, rights, complaints and the rest. Each item is marked present, partial or missing, and every mark shows the sentence behind it.

The scan has limits, and the report says so. It reads the notice as written and can’t see what your systems actually collect, who really receives the data or how long it’s kept, so it can’t say whether a notice is accurate. Mismatches between the notice and the site are the job of other checks, such as UK-06. It doesn’t read your contracts, and a notice inside a separate app is outside what it sees. A Passed means the expected items were found on the pages scanned. It doesn’t say the notice is complete in law.

Why it matters for a company

In the TikTok decision the ICO found that users, and particularly children, were not given clear information about how their data was collected, used and shared. The penalty was £12.7 million, and the ICO announced on 24 September 2026 that TikTok had withdrawn its appeal. The information failure was one of several findings.

The smaller-company record is thinner, and the case is not a typical one. Doorstep Dispensaree, a pharmacy, was penalised mainly for how it stored and destroyed paper records. Among the facts the First-tier Tribunal recorded was that the company “did not provide data subjects with the information required by Articles 13 and/or 14”, and it noted that the company accepted its privacy notice was inadequate. The tribunal cut the penalty from £275,000 to £92,000, and upheld the enforcement notice issued in December 2019. The tribunal recorded that the company accepted its data protection policies, particularly its privacy notice and its retention and destruction policies, were inadequate in August 2018, and found that its policies still did not fully comply as of September 2019. The Court of Appeal rejected the company’s further appeal in December 2024.

Notice gaps tend to surface when something else has already drawn the regulator’s attention, so they are cited alongside other findings. An enforcement notice can require the notice to be rewritten, as in the pharmacy’s case. And since mid-2026 an old complaints line or an EU law reference is an easy gap to leave.

Smaller companies and larger companies

The duty has no size threshold. A sole trader with a contact form and a platform with millions of users are both within Articles 13 and 14.

In a small company the notice is usually a template or a generator’s output, adapted once. The common gaps are the ones the UK text now makes easier to hit: a notice that still describes complaints only to a supervisory authority, no named recipients, a retention line that says “as long as necessary”, and an EU reference where the UK law applies. Nobody has the job of rereading the notice.

In a larger company the problem is spread across teams. Legal owns the purposes, marketing adds a tracker, and a new supplier changes the recipients without anyone updating the text. Articles 13 and 14 both apply, because the company collects some data directly and receives other data from partners, and the Article 14 source and timing items are easy to miss. When children use the service, Article 12 asks for language they can follow.

How to fix it

1. Write down what you actually do with personal data. List each purpose, the data used, who receives it, where it goes and how long you keep it. The notice can only be as accurate as this list.
2. Tick your notice against the Article 13 list. Check each item, from controller contact details to automated decisions. If you receive data from others, tick Article 14 as well, including the source and the categories of data.
3. Update the complaint wording. Say that people can complain to you, and say how. Say that they can complain to the regulator, using the UK wording.
4. Be specific. Tie each legal basis to a purpose, name the recipients or their categories as precisely as you can, and replace “as long as necessary” with a period or the rule you use to set one.
5. Check the transfer wording. Name the countries data goes to and the safeguard relied on, using UK rather than EU terms.
6. Link it where you collect. Put the notice on the form or checkout and in the footer. Where there are many organisations to describe, the ICO’s common issues page suggests a layered approach.
7. Keep it current. When you add a supplier or a purpose, update the notice the same week.
8. Re-scan. Run a scan again. Each missing or partial item shows the sentence behind it, so you can see what changed.

Whether a notice satisfies the ICO is a question for your legal adviser, and Peeky reports only what it reads.